I work at a bank (opinions my own) and nearly everything we do (including modernization, but especially partnership communications) is FTP-based. It's just about the only real standard available when the code is older than most of the devs. We do use modern encryption and mutual TLS to authenticate and encrypt everything, including before password transmission when that's even an option, but FTP is still the backbone of a ton of big older businesses.